Key takeaways
- →CASL recognizes two kinds of consent — express (an explicit opt-in) and implied (based on an existing relationship) — and only one of them ever expires.
- →Implied consent from an existing business relationship lasts 2 years from the last transaction; implied consent from a mere inquiry or application lasts only 6 months.
- →Every commercial electronic message needs sender identification and a working unsubscribe mechanism, and unsubscribe requests must be honoured within 10 business days.
- →Penalties are not symbolic — CASL sets maximum administrative monetary penalties of up to $1 million for an individual and $10 million for a business, per violation.
Most mortgage CRMs are full of past clients a broker would happily re-engage — a renewal reminder, a rate-drop alert, a referral ask. The instinct to just email the whole list runs straight into a rule most brokers have heard of but never actually tracked: CASL consent isn't permanent, and one of its two forms has a hard expiry date.
Here's the distinction that actually matters for a working CRM, not just the general CASL overview most brokers have already skimmed once.
01 · Why does CASL matter more for a CRM than for a one-off email?
A single email to a single client rarely triggers a CASL problem — context usually makes consent obvious. The risk shows up at scale, when a CRM segment, drip campaign, or newsletter blast reaches hundreds of contacts at once, some of whom gave clear consent recently and some of whom haven't had an active relationship with the brokerage in years.
CASL applies to any commercial electronic message — email, text, and most direct social messages — sent to an electronic address, which covers the overwhelming majority of what a mortgage CRM actually sends.
02 · What's the actual difference between express and implied consent?
Express consent means the recipient took a clear, proactive action to opt in — checking a box, submitting a form, or otherwise clearly agreeing — and once given, it doesn't expire on its own.
Implied consent is inferred from context rather than a direct opt-in, and it comes with a shelf life. Per the CRTC's CASL guidance, implied consent based on an existing business relationship — a closed mortgage, a signed engagement — lasts 2 years from the date of that last transaction. Implied consent based on a mere inquiry or application, with no completed transaction, lasts only 6 months.
03 · Where does a CRM quietly fall out of compliance without anyone noticing?
A client whose mortgage closed just over two years ago, who never explicitly opted into ongoing marketing, has aged out of implied consent — even though they're still sitting in the same “past clients” segment as someone who closed six months ago. Most CRMs don't flag this distinction automatically; they just show a contact and a send button.
The same applies, on a much faster clock, to leads who inquired but never closed — six months after that inquiry, implied consent has already lapsed, well before most brokers think to stop emailing them.
04 · What does every commercial electronic message legally need to include?
Regardless of consent type, every commercial electronic message needs to clearly identify the sender and include a working unsubscribe mechanism. Once someone unsubscribes, the request has to be honoured within 10 business days — not “eventually,” and not just from that one campaign.
05 · How do you actually build the consent clock into your CRM?
Tag every contact with the consent type (express or implied) and the date it was established, then let that date drive a segment exclusion — not a manual review. A simple rule does most of the work: implied-consent contacts automatically drop out of marketing sends at the two-year (transaction) or six-month (inquiry-only) mark unless they've since given express consent.
This is worth setting up once as a standing rule rather than auditing manually before every send — the whole point of tracking the clock is that nobody has to remember it.
Marketing that holds up, not just converts
Reach clients without gambling on stale consent.
If your growth strategy leans on outreach at scale, Treadstone's viral marketing team builds campaigns around defensible consent, not assumptions. See how that works on a free call.
Frequently asked questions
This article is general information to help you scale — not a substitute for tailored advice on your specific business, licensing, or compliance obligations. All figures are illustrative examples for planning purposes; actual costs vary by province, market, and brokerage.